A method and system for customizing updates to an embedded threat intelligence library

Abstract

This disclosure provides a method and system for updating a customized embedded threat intelligence database. The method includes: a security detection device extracting network identification information from interface traffic and matching the network identification information with intelligence data in a local whitelist; if the first match fails, performing a second match between the network identification information and intelligence data in the local threat intelligence database; if the second match fails, generating a query request carrying the network identification information; responding to the query request, a cloud server querying its real-time threat intelligence data to see if target intelligence data corresponding to the network identification information carried in the query request exists; if the query result indicates the existence of target intelligence data, adding the network identification information to the customized embedded threat intelligence database and updating the version number of the customized embedded threat intelligence database. This method can improve the utilization rate of threat intelligence in the customized embedded threat intelligence database.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity, and more particularly to a method and system for updating a customized embedded threat intelligence database. Background Technology

[0002] Security detection equipment is deployed in bypass mode on the user's network. By monitoring network traffic and utilizing known threat intelligence data, it promptly detects security incidents and issues alerts. Complete threat intelligence data is vast and primarily deployed on cloud servers, provided externally as a threat intelligence data query service. While the security detection equipment has embedded threat intelligence data for security detection, this embedded data is limited by its volume and cannot be comprehensive. Therefore, frequent updates are necessary to maintain the effectiveness and timeliness of the threat intelligence data.

[0003] In existing technologies, large amounts of threat intelligence data are periodically simplified manually to generate new embedded threat intelligence databases. Security detection devices then periodically download these new embedded threat intelligence datasets to update the databases. However, manual labor is costly and cannot guarantee the selection of high-value threat intelligence data from the datasets, resulting in low usability of the embedded threat intelligence datasets. Summary of the Invention

[0004] In view of this, the present disclosure provides a method and system for updating a customized embedded threat intelligence database, which enables a cloud server to work with security detection devices to generate a targeted customized embedded threat intelligence database, thereby improving intelligence utilization.

[0005] In a first aspect, embodiments of this disclosure provide a method for updating a customized embedded threat intelligence database for use in security detection devices and cloud servers, employing the following technical solution:

[0006] The method for updating the customized embedded threat intelligence database includes:

[0007] The security detection equipment extracts network identification information from the interface traffic and matches the network identification information with intelligence data in the local whitelist.

[0008] If the first match fails, the security detection device will perform a second match between the network identification information and the intelligence data in the local threat intelligence database.

[0009] If the second match fails, the security detection device generates a query request carrying network identification information and sends the query request to the cloud server.

[0010] In response to the query request, the cloud server checks its own real-time threat intelligence data to see if there is target intelligence data corresponding to the network identification information carried in the query request, and sends the query results to the security detection device;

[0011] If the query results indicate the existence of target intelligence data, the cloud server will add the network identification information to the customized embedded threat intelligence database and update the version number of the customized embedded threat intelligence database.

[0012] Optionally, after matching the network identification information with the intelligence data in the local whitelist, the method for updating the customized embedded threat intelligence database further includes: if the match is successful, the security detection device generates a security log indicating that the traffic corresponding to the network identification information is not threatening and that the network identification information has been filed in the local whitelist.

[0013] Optionally, after the security detection device performs a secondary match between the network identification information and the intelligence data in the local threat intelligence database, the method for updating the customized embedded threat intelligence database further includes: if the secondary match is successful, the security detection device generates a security log indicating that the traffic corresponding to the network identification information is threatening and that the network identification information has been filed in the local threat intelligence database.

[0014] Optionally, after sending the query results to the security detection device, the method for updating the customized embedded threat intelligence database further includes: the security detection device receiving the query results; if the query results indicate the existence of target intelligence data, generating a security log indicating that the traffic corresponding to the network identification information is threatening, but the network identification information is not registered in the local threat intelligence database; and downloading the latest version of the customized embedded threat intelligence database from the cloud server to update the local threat intelligence database.

[0015] Optionally, after sending the query results to the security detection device, the method for updating the customized embedded threat intelligence database further includes: the security detection device receiving the query results; if the query results indicate that the target intelligence data does not exist, it generates a security log indicating that the traffic corresponding to the network identification information is not threatening, but the network identification information is not registered in the local whitelist, and adds the network identification information to the local whitelist.

[0016] Optionally, after adding network identification information to the local whitelist, the method for updating the customized embedded threat intelligence database further includes: the security detection device determining the total number of intelligences in the local whitelist; if the total number of intelligences is greater than a preset threshold, then deleting intelligence data with a longer filing time from the local whitelist.

[0017] Optionally, sending the query request to the cloud server includes: the security detection device starting a timer from the moment the query request is generated, determining whether it repeatedly generates other query requests carrying network identification information within a preset detection period; if the security detection device repeatedly generates other query requests carrying network identification information within the preset detection period, the security detection device merges all duplicate query requests into one query request and sends the merged query request to the cloud server after the preset detection period; if the security detection device does not repeatedly generate other query requests carrying network identification information within the preset detection period, the security detection device directly sends the query request to the cloud server after the preset detection period.

[0018] Optionally, the method for updating the customized embedded threat intelligence database further includes: the security detection device periodically comparing the version number of the local threat intelligence database with the version number of the customized embedded threat intelligence database, and downloading the latest version of the customized embedded threat intelligence database from the cloud server to update the local threat intelligence database if the version number of the customized embedded threat intelligence database is newer.

[0019] Optionally, the method for updating the customized embedded threat intelligence database further includes: the cloud server periodically comparing the data in the customized embedded threat intelligence database with its own real-time threat intelligence data, and deleting expired data in the customized embedded threat intelligence database based on the comparison results.

[0020] Secondly, this disclosure also provides an update system for a customized embedded threat intelligence database. The update system includes a security detection device and a cloud server. The security detection device further includes an extraction module, a primary matching module, a secondary matching module, a query request generation module, and a first sending module. The cloud server further includes a query module, a second sending module, and an update module.

[0021] The extraction module is used to extract network identification information from interface traffic;

[0022] The first-match module is used to match network identification information with intelligence data in the local whitelist.

[0023] The secondary matching module is used to perform a secondary matching between the network identification information and the intelligence data in the local threat intelligence database if the first matching fails.

[0024] The query request generation module is used to generate a query request carrying network identification information if the secondary matching fails.

[0025] The first sending module is used to send query requests to the cloud server;

[0026] The query module is used to respond to query requests and check whether there is target intelligence data in its own real-time threat intelligence data that corresponds to the network identification information carried in the query request;

[0027] The second sending module is used to send the query results to the security detection device.

[0028] The update module is used to add network identification information to the customized embedded threat intelligence database and update the version number of the customized embedded threat intelligence database if the query result shows that target intelligence data exists.

[0029] Thirdly, embodiments of this disclosure also provide an update system for a customized embedded threat intelligence database, the update system comprising a security detection device and a cloud server; wherein,

[0030] The security detection device includes at least one first processor and a first memory communicatively connected to the at least one first processor, wherein the first memory stores instructions executable by the at least one first processor, the instructions being executed by the at least one first processor to enable the at least one first processor to execute a method for updating a customized embedded threat intelligence database.

[0031] The cloud server includes at least one second processor on each business board, and a second memory communicatively connected to the at least one second processor, wherein the second memory stores instructions executable by the at least one second processor, the instructions being executed by the at least one second processor to enable the at least one second processor to execute a method for updating a customized embedded threat intelligence database.

[0032] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions for causing a computer to execute any of the above-described methods for updating a customized embedded threat intelligence database.

[0033] As described above, when updating the customized embedded threat intelligence database in this embodiment, the security detection device first extracts network identification information from the interface traffic and matches the network identification information with the intelligence data in the local whitelist. If the first match fails, the security detection device performs a second match between the network identification information and the intelligence data in the local threat intelligence database. If the second match fails, the security detection device generates a query request carrying the network identification information and sends the query request to the cloud server. In response to the query request, the cloud server checks whether there is target intelligence data in its real-time threat intelligence data that corresponds to the network identification information carried in the query request, and sends the query result to the security detection device. If the query result indicates that target intelligence data exists, the cloud server adds the network identification information to the customized embedded threat intelligence database and updates the version number of the customized embedded threat intelligence database.

[0034] On one hand, the cloud server only initiates the query operation after responding to the query request from the security detection device. If the query result indicates the existence of target intelligence data, it promptly adds the network identification information to the customized embedded threat intelligence database to complete the registration of the network identification information. Simultaneously, it updates the version number of the customized embedded threat intelligence database in a timely manner, enabling the security detection device to update its local threat intelligence database accordingly. This setup allows the cloud server to work in conjunction with the security detection device to generate a targeted customized embedded threat intelligence database, thereby ensuring the effectiveness and timeliness of the intelligence data in the customized embedded threat intelligence database. Furthermore, it ensures that each piece of intelligence data in the customized embedded threat intelligence database is targeted and usable, thus improving intelligence utilization.

[0035] On the other hand, before sending query requests to the cloud server, the security detection server adds a whitelist matching step in addition to the local threat intelligence database matching step. Only network identifiers that cannot be matched in the whitelist can be matched to the local threat intelligence database. Therefore, it can promptly identify security traffic that does not pose a threat and avoid generating query requests based on this security traffic, thereby reducing the processing pressure on the cloud server caused by the continuous sending of query requests by the security detection device.

[0036] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A flowchart illustrating the method for updating a customized embedded threat intelligence database provided in this embodiment of the disclosure;

[0039] Figure 2 A flowchart illustrating a method for updating a customized embedded threat intelligence database, as provided in another embodiment of this disclosure;

[0040] Figure 3 A flowchart illustrating a method for updating a customized embedded threat intelligence database, as provided in yet another embodiment of this disclosure;

[0041] Figure 4 A flowchart illustrating a method for updating a customized embedded threat intelligence database, as provided in yet another embodiment of this disclosure;

[0042] Figure 5 A structural block diagram of an update system for a customized embedded threat intelligence database provided in yet another embodiment of this disclosure;

[0043] Figure 6 This is a schematic block diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0044] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0045] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0046] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0047] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0048] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0049] This disclosure provides a method for updating a customized embedded threat intelligence database, applicable to security detection devices and cloud servers. See also... Figure 1 The customized embedded threat intelligence database includes steps 101 to 106.

[0050] In step 101, the security detection device extracts network identification information from the interface traffic and matches the network identification information with intelligence data in the local whitelist.

[0051] In this step, the security detection device will activate its threat intelligence learning function to perform a preliminary analysis of the traffic received by the interface and extract relevant network identification information from the traffic. For example, network identification information includes, but is not limited to, file hashes, IP addresses, domain names, and URLs.

[0052] The whitelist is used to store network identification information of users with good behavior.

[0053] In one example, before the security detection device enables the threat intelligence learning function, the whitelist is empty. After the threat intelligence learning function is enabled, the network identification information of users with good behavior can be gradually added to the whitelist through continuous learning, forming a whitelist with high usability value.

[0054] In another example, security detection devices can also directly import historical whitelists and continuously update the intelligence data in the whitelists during subsequent learning to form a customized whitelist with high usability value; this is not limited here.

[0055] In step 102, if the first match fails, the security detection device will perform a second match between the network identification information and the intelligence data in the local threat intelligence database.

[0056] In this step, "one match failed" means that the security detection device failed to detect the intelligence data corresponding to the network identification information in the whitelist. Therefore, it cannot be determined whether the traffic corresponding to the network identification information is threatening. It is necessary to continue to match the network identification information with the intelligence data in the local threat intelligence database.

[0057] The local threat intelligence database is an embedded threat intelligence database built into the security detection device. In practice, the security detection device can download the embedded threat intelligence database from a cloud server to generate the local threat intelligence database.

[0058] In one example, before the threat intelligence learning function is enabled on the security detection device, the local threat intelligence database is empty. After the threat intelligence learning function is enabled, the security detection device works with the cloud server to continuously learn and enable the cloud server to gradually add the network identification information of threatening users into the embedded threat intelligence database, forming a customized embedded threat intelligence database with high availability value.

[0059] In another example, security detection devices can also directly import historical embedded threat intelligence databases and continuously update the intelligence data in the historical embedded threat intelligence databases during subsequent learning processes, forming a customized embedded threat intelligence database with high usability value.

[0060] In step 103, if the second matching fails, the security detection device generates a query request carrying network identification information.

[0061] In this step, "secondary matching failed" means that the security detection device failed to detect the intelligence data corresponding to the network identification information in the local threat intelligence database. Therefore, it is still impossible to determine whether the traffic corresponding to the network identification information is threatening. It is necessary to send a query request to the cloud server, so that the cloud server can further match the network identification information with its own real-time threat intelligence data.

[0062] In step 104, the security detection device sends a query request to the cloud server.

[0063] In step 105, in response to the query request, the cloud server queries its own real-time threat intelligence data to see if there is target intelligence data corresponding to the network identification information carried in the query request, and sends the query result to the security detection device.

[0064] In step 106, if the query result indicates the existence of target intelligence data, the cloud server adds the network identification information to the customized embedded threat intelligence database and updates the version number of the customized embedded threat intelligence database.

[0065] In this step, the message "The query result shows that target intelligence data exists" indicates that the traffic corresponding to the network identification information is threatening, but the security detection device's local threat intelligence database has not registered it. Since the local threat intelligence database is updated based on the latest version of the customized embedded threat intelligence database on the cloud server, the customized embedded threat intelligence database on the cloud server must also not have registered this network identification information.

[0066] In this scenario, to improve the effectiveness and timeliness of the intelligence data in the local threat intelligence database, the cloud server can promptly add the network identification information to the customized embedded threat intelligence database, complete the filing of the network identification information, and update the version number of the customized embedded threat intelligence database so that security detection devices can update the local threat intelligence database accordingly.

[0067] For example, the version number naming method of a custom embedded threat intelligence database is: TI-v2020.09.15.01, where TI represents the type of custom embedded threat intelligence database, and 2020.09.15.01 represents the year, month, day and number. If the cloud server updates the custom embedded threat intelligence database multiple times on the same day, including adding, deleting or changing, the year, month and day in the version number of the custom embedded threat intelligence database will remain unchanged, and the number will be incremented sequentially according to the time sequence.

[0068] As an example, a security detection device can periodically (e.g., once a day) compare the version number of the local threat intelligence database with the version number of the custom embedded threat intelligence database, and download the latest version of the custom embedded threat intelligence database from the cloud server to update the local threat intelligence database if the version number of the custom embedded threat intelligence database is newer.

[0069] As another example, the security detection device can first receive the query results. If the query results indicate the existence of target intelligence data, it means that the customized embedded threat intelligence database on the cloud server has promptly completed the registration of the network identification information and updated the version number of the customized embedded threat intelligence database. At this time, the security detection device can, on the one hand, generate a security log indicating that the traffic corresponding to the network identification information is threatening, but the network identification information is not registered in the local threat intelligence database, to end this traffic detection; on the other hand, it can download the latest version of the customized embedded threat intelligence database from the cloud server after a slight delay to update the local threat intelligence database.

[0070] As described above, when updating the customized embedded threat intelligence database in this embodiment, the security detection device first extracts network identification information from the interface traffic and matches the network identification information with the intelligence data in the local whitelist. If the first match fails, the security detection device performs a second match between the network identification information and the intelligence data in the local threat intelligence database. If the second match fails, the security detection device generates a query request carrying the network identification information and sends the query request to the cloud server. In response to the query request, the cloud server checks whether there is target intelligence data in its real-time threat intelligence data that corresponds to the network identification information carried in the query request, and sends the query result to the security detection device. If the query result indicates that target intelligence data exists, the cloud server adds the network identification information to the customized embedded threat intelligence database and updates the version number of the customized embedded threat intelligence database.

[0071] On one hand, the cloud server only initiates the query operation after responding to the query request from the security detection device. If the query result indicates the existence of target intelligence data, it promptly adds the network identification information to the customized embedded threat intelligence database to complete the registration of the network identification information. Simultaneously, it updates the version number of the customized embedded threat intelligence database in a timely manner, enabling the security detection device to update its local threat intelligence database accordingly. This setup allows the cloud server to work in conjunction with the security detection device to generate a targeted customized embedded threat intelligence database, thereby ensuring the effectiveness and timeliness of the intelligence data in the customized embedded threat intelligence database. Furthermore, it ensures that each piece of intelligence data in the customized embedded threat intelligence database is targeted and usable, thus improving intelligence utilization.

[0072] On the other hand, before sending query requests to the cloud server, the security detection server adds a whitelist matching step in addition to the local threat intelligence database matching step. Only network identifiers that cannot be matched in the whitelist can be matched to the local threat intelligence database. Therefore, it can promptly identify security traffic that does not pose a threat and avoid generating query requests based on this security traffic, thereby reducing the processing pressure on the cloud server caused by the continuous sending of query requests by the security detection device.

[0073] In some implementations, the cloud server can also periodically compare the data in the customized embedded threat intelligence database with its own real-time threat intelligence data, and delete outdated data in the customized embedded threat intelligence database based on the comparison results, and generate a new customized embedded threat intelligence database, thereby further ensuring the effectiveness and timeliness of the intelligence data in the customized embedded threat intelligence database.

[0074] Figure 2 This is a flowchart illustrating another method for updating a customized embedded threat intelligence database, provided as an embodiment of this disclosure, for use in security detection devices and cloud servers. See also... Figure 2 , Figure 2 and Figure 1 The difference is that, Figure 1 Step 104 in the text can be further refined as follows: Figure 2 Steps 1041 to 1043 in the process.

[0075] In step 1041, the security detection device starts timing from the time the query request is generated, and determines whether it repeatedly generates other query requests carrying network identification information within the preset detection time.

[0076] In step 1042, if the security detection device repeatedly generates other query requests carrying network identification information within the preset detection time, the security detection device merges all duplicate query requests into one query request and sends the merged query request to the cloud server after the preset detection time.

[0077] The preset detection duration can be set according to actual needs. For example, the preset detection duration can be set to 30 seconds. For instance, if the security detection device receives multiple duplicate traffic requests to a certain domain name www.test.com within 30 seconds, the security detection device will only generate one query request, reducing the number of duplicate query requests sent to the cloud server and thus alleviating the processing pressure on the cloud server.

[0078] In step 1043, if the security detection device does not repeatedly generate other query requests carrying network identification information within the preset detection time, the security detection device will directly send the query request to the cloud server after the preset detection time.

[0079] As described above, in this embodiment of the present disclosure, before sending a query request to the cloud server, the security detection server adds a query request merging step in addition to the local threat intelligence database matching step and the whitelist matching step. This setting can avoid sending duplicate query requests to the cloud server, thereby further reducing the processing pressure on the cloud server caused by the continuous sending of query requests by the security detection device.

[0080] Figure 3 This is a flowchart illustrating another method for updating a customized embedded threat intelligence database, provided as an embodiment of the present disclosure, for use in security detection devices and cloud servers. Figure 3 and Figure 1 The difference is that, Figure 3 The process further includes step 107 after step 101, step 108 after step 105, and step 109 after step 102.

[0081] In step 107, if a match is successful, the security detection device generates a security log indicating that the traffic corresponding to the network identification information is not threatening and that the network identification information has been registered in the local whitelist.

[0082] In this step, a "successful match" indicates that the security detection device has detected the intelligence data corresponding to the network identification information in the whitelist. At this point, it can be determined that the traffic corresponding to the network identification information is not threatening. In this case, the security detection device can end the traffic detection by generating a security log indicating that the traffic corresponding to the network identification information is not threatening and that the network identification information has been registered in the local whitelist. For example, for traffic that is not threatening, the security detection device can report and process it as normal traffic.

[0083] In step 108, the security detection device receives the query result. If the query result indicates that there is no target intelligence data, it generates a security log indicating that the traffic corresponding to the network identification information is not threatening, but the network identification information is not registered in the local whitelist, and adds the network identification information to the local whitelist.

[0084] In this step, the message "The query result shows no target intelligence data" indicates that the traffic corresponding to the network identifier is not threatening, but the security detection device's whitelist does not include this network identifier information. In this situation, the security detection device can either terminate the traffic detection by generating a security log indicating that the traffic corresponding to the network identifier information is not threatening, but the network identifier information is not registered in the local whitelist; or it can promptly add the network identifier information to the local whitelist, ensuring the validity and timeliness of the intelligence data in the whitelist, and guaranteeing that each piece of intelligence data in the whitelist is targeted and usable.

[0085] Furthermore, considering that whitelists have an aging period, in order to prevent some data from becoming undetectable after it becomes threatening data, the security detection device can also determine the total number of intelligence in the local whitelist. If the total number of intelligence exceeds a preset threshold, intelligence data with a longer filing time in the local whitelist will be deleted.

[0086] In step 109, if the secondary matching is successful, the security detection device generates a security log indicating that the traffic corresponding to the network identification information is threatening and that the network identification information has been filed in the local threat intelligence database.

[0087] In this step, a "successful secondary match" indicates that the security detection device has detected the intelligence data corresponding to the network identification information in the local threat intelligence database. At this point, it can be determined that the traffic corresponding to the network identification information is threatening. Therefore, the security detection device can generate a security log indicating that the traffic corresponding to the network identification information is threatening and that the network identification information has been registered in the local threat intelligence database, thereby ending this traffic detection. For example, for threatening traffic, the security detection device can report and process it as attack traffic.

[0088] To facilitate understanding by those skilled in the art, the following is combined with Figure 4 The method for updating the customized embedded threat intelligence database in the embodiments of this disclosure will be described in detail.

[0089] Step 401: The security detection equipment receives and analyzes the interface traffic.

[0090] In this step, the security detection device activates its threat intelligence learning function. The security detection device will perform a preliminary analysis of the traffic received by the interface and extract relevant information from the traffic, including but not limited to file hashes, IP addresses, domain names, and URLs.

[0091] Step 402: The security detection equipment matches the relevant information with the whitelist.

[0092] In this step, the security detection device will compare the relevant information with the whitelist. If a match is found, proceed to step 403; otherwise, proceed to step 404.

[0093] Step 403: The security detection device generates a security log without sending a query request to the cloud server.

[0094] Step 404: The security detection device matches the relevant information with the local threat intelligence database.

[0095] In this step, the security detection device compares relevant information with the local threat intelligence database. If a match is found, proceed to step 405; otherwise, proceed to step 406.

[0096] Step 405: The security detection device generates a security log without sending a query request to the cloud server.

[0097] Step 406: Send the relevant information to the cloud server for querying.

[0098] Step 407: Query real-time threat intelligence data on the cloud server.

[0099] In this step, the cloud server compares the relevant information with its own real-time threat intelligence data. If the relevant information is found, proceed to step 408; otherwise, proceed to step 409.

[0100] In step 408, the cloud server will write the relevant information into the customized embedded threat intelligence database and return alarm information to the security detection device.

[0101] Step 409: The security detection equipment adds the relevant information to the whitelist.

[0102] This invention provides an update system for a customized embedded threat intelligence database, see below. Figure 5 The customized embedded threat intelligence database update system includes a security detection device 50 and a cloud server 51. The security detection device 50 further includes an extraction module 501, a primary matching module 502, a secondary matching module 503, a query request generation module 504, and a first sending module 505. The cloud server 51 further includes a query module 511, a second sending module 512, and an update module 513.

[0103] The extraction module 501 is used to extract network identification information from interface traffic.

[0104] The first matching module 502 is used to match the network identification information with the intelligence data in the local whitelist.

[0105] The secondary matching module 503 is used to perform a secondary matching between the network identification information and the intelligence data in the local threat intelligence database if the primary matching fails.

[0106] The query request generation module 504 is used to generate a query request carrying network identification information if the secondary matching fails.

[0107] The first sending module 505 is used to send query requests to the cloud server.

[0108] The query module 511 is used to respond to a query request and check whether there is target intelligence data in its own real-time threat intelligence data that corresponds to the network identification information carried in the query request.

[0109] The second sending module 512 is used to send the query results to the security detection device.

[0110] The update module 513 is used to add target intelligence data to the customized embedded threat intelligence database if the query result shows that target intelligence data exists, and update the version number of the customized embedded threat intelligence database.

[0111] This disclosure also provides an update system for a customized embedded threat intelligence database, which includes a security detection device and a cloud server; wherein,

[0112] The security detection device includes at least one first processor and a first memory communicatively connected to the at least one first processor, wherein the first memory stores instructions executable by the at least one first processor, the instructions being executed by the at least one first processor to enable the at least one first processor to perform the method for updating the customized embedded threat intelligence database as described above.

[0113] The cloud server includes at least one second processor on each business board, and a second memory communicatively connected to the at least one second processor, wherein the second memory stores instructions executable by the at least one second processor, the instructions being executed by the at least one second processor to enable the at least one second processor to execute the method for updating the customized embedded threat intelligence database as described above.

[0114] The memory according to embodiments of this disclosure is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc.

[0115] The processor may be a central processing unit (CPU) or other processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the customized embedded threat intelligence database update method described in the foregoing embodiments of this disclosure.

[0116] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0117] like Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the electronic device in the embodiment of the present disclosure. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0118] like Figure 6 As shown, an electronic device may include a processing unit (such as a central processing unit, graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0119] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 6 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0120] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from ROM. When the computer program is executed by a processing device, all or part of the steps of the method for updating a customized embedded threat intelligence database according to embodiments of this disclosure are performed.

[0121] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0122] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the customized embedded threat intelligence database update method described in the foregoing embodiments of the present disclosure are performed.

[0123] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0124] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0125] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0126] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0127] Additionally, as used herein, the “or” used in a list of items beginning with “at least one” indicates a separate list, such that a list of, for example, “at least one of A, B, or C” means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word “exemplary” does not imply that the described example is preferred or better than other examples.

[0128] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0129] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0130] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0131] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for customizing updates of an embedded threat intelligence repository for security detection devices and cloud servers, characterized in that, The method comprises the following steps: The security detection device extracts network identification information in interface traffic after starting a threat intelligence learning function, and performs a first matching between the network identification information and intelligence data in a local whitelist; If the first matching is unsuccessful, the security detection device performs a second matching between the network identification information and intelligence data in a local threat intelligence library; The local threat intelligence library is an embedded threat intelligence library built in the security detection device, and the content in the local threat intelligence library is empty before the security detection device starts the threat intelligence learning function. After the threat intelligence learning function is started, the security detection device is linked with a cloud server, and the network identification information extracted by the security detection device is sequentially subjected to the first matching and the second matching between the network identification information and intelligence data in the local whitelist and the local threat intelligence library, so that the cloud server gradually adds network identification information of a user with a threat into the embedded threat intelligence library to form a customized embedded threat intelligence library. Alternatively, the security detection device imports a historical embedded threat intelligence library, and the network identification information extracted by the security detection device is sequentially subjected to the first matching and the second matching between the network identification information and intelligence data in the local whitelist and the local threat intelligence library, so that the cloud server continuously updates intelligence data in the historical embedded threat intelligence library to form a customized embedded threat intelligence library; If the second matching is unsuccessful, the security detection device generates a query request carrying the network identification information, and sends the query request to the cloud server; In response to the query request, the cloud server queries whether target intelligence data corresponding to the network identification information carried by the query request exists in real-time threat intelligence data of the cloud server, and sends a query result to the security detection device; If the query result is that the target intelligence data exists, the cloud server adds the network identification information to a customized embedded threat intelligence library, and updates a version number of the customized embedded threat intelligence library; After the query result is sent to the security detection device, the method further comprises the following steps: The security detection device receives the query result, and if the query result is that the target intelligence data does not exist, generates a security log indicating that traffic corresponding to the network identification information does not have a threat, but the network identification information is not recorded in the local whitelist, and adds the network identification information to the local whitelist; After the network identification information is added to the local whitelist, the method further comprises the following steps: The security detection device determines a total number of intelligence in the local whitelist, and if the total number of intelligence is greater than a preset threshold, deletes intelligence data recorded for a longer time in the local whitelist.

2. The method of customizing updates to an embedded threat intelligence feed of claim 1, wherein, After the network identification information is subjected to the first matching with intelligence data in the local whitelist, the method further comprises the following steps: If the first matching succeeds, the security detection device generates a security log indicating that the traffic corresponding to the network identification information is not threatening and that the network identification information has been recorded in the local whitelist.

3. The method of customizing updates to an embedded threat intelligence feed of claim 1, wherein, After the security detection device performs the second matching of the network identification information with the intelligence data in the local threat intelligence library, the method further includes: If the second matching succeeds, the security detection device generates a security log indicating that the traffic corresponding to the network identification information is threatening and that the network identification information has been recorded in the local threat intelligence library.

4. The method of customizing updates to an embedded threat intelligence feed of claim 1, wherein, After the sending of the query result to the security detection device, the method further includes: The security detection device receives the query result, and if the query result is that the target intelligence data exists, generates a security log indicating that the traffic corresponding to the network identification information is threatening and that the network identification information has not been recorded in the local threat intelligence library, and downloads the latest version of the customized embedded threat intelligence library from the cloud server to update the local threat intelligence library.

5. The method of customizing updates to an embedded threat intelligence feed of claim 1, wherein, The sending of the query request to the cloud server includes: The security detection device starts timing from the time when the query request is generated, and determines whether the security detection device repeatedly generates other query requests carrying the network identification information within a preset detection time length; If the security detection device repeatedly generates other query requests carrying the network identification information within the preset detection time length, the security detection device combines all the repeated query requests into one query request, and sends the combined query request to the cloud server after the preset detection time length; If the security detection device does not repeatedly generate other query requests carrying the network identification information within the preset detection time length, the security detection device directly sends the query request to the cloud server after the preset detection time length.

6. The method of customizing updates to an embedded threat intelligence feed of claim 1, wherein, The method further includes: The security detection device periodically compares the version number of the local threat intelligence library with the version number of the customized embedded threat intelligence library, and downloads the latest version of the customized embedded threat intelligence library from the cloud server to update the local threat intelligence library if the version number of the customized embedded threat intelligence library is newer.

7. The method of customizing updates to an embedded threat intelligence feed of claim 1, wherein, The method further includes: The cloud server periodically compares the data in the customized embedded threat intelligence library with real-time threat intelligence data of the cloud server, and deletes the data in the customized embedded threat intelligence library that has expired according to the comparison result.

8. A system for updating a customized embedded threat intelligence database, characterized in that, The method further includes: The security detection device and the cloud server, the security detection device further includes an extraction module, a first matching module, a second matching module, a query request generation module and a first sending module, and the cloud server further includes a query module, a second sending module and an update module; wherein, The extraction module is configured to extract network identification information in interface traffic after starting a threat intelligence learning function; The first matching module is configured to perform a first matching of the network identification information with intelligence data in a local whitelist; The second matching module is configured to perform a second matching of the network identification information with intelligence data in a local threat intelligence library. The secondary matching module is configured to perform secondary matching of the network identification information with intelligence data in a local threat intelligence library if the primary matching is unsuccessful. The local threat intelligence library is an embedded threat intelligence library built in the security detection device, and the content of the local threat intelligence library is empty before the security detection device starts a threat intelligence learning function. After the threat intelligence learning function is started, the security detection device is linked with a cloud server, and the network identification information extracted by the security detection device is sequentially matched with intelligence data in a local whitelist and the local threat intelligence library to perform primary matching and secondary matching, so that the cloud server gradually adds network identification information of a user with a threat into the embedded threat intelligence library to form a customized embedded threat intelligence library. Alternatively, the security detection device imports a historical embedded threat intelligence library, and the network identification information extracted by the security detection device is sequentially matched with intelligence data in a local whitelist and the local threat intelligence library to perform primary matching and secondary matching, so that the cloud server continuously updates intelligence data in the historical embedded threat intelligence library to form a customized embedded threat intelligence library. The query request generation module is configured to generate a query request carrying the network identification information if the secondary matching is unsuccessful. The first sending module is configured to send the query request to the cloud server. The query module is configured to query whether target intelligence data corresponding to the network identification information carried in the query request exists in real-time threat intelligence data of the cloud server in response to the query request. The second sending module is configured to send the query result to the security detection device. The update module is configured to add the network identification information into a customized embedded threat intelligence library and update a version number of the customized embedded threat intelligence library if the query result is that the target intelligence data exists. After the query result is sent to the security detection device, the following operations are included: The security detection device receives the query result, and generates a security log indicating that traffic corresponding to the network identification information is not threatening and the network identification information is not recorded in the local whitelist if the query result is that the target intelligence data does not exist, and adds the network identification information into the local whitelist. After the network identification information is added into the local whitelist, the following operations are included:

9. A system for updating a customized embedded threat intelligence database, characterized in that, The security detection device determines a total number of intelligence in the local whitelist, and deletes intelligence data recorded for a longer time in the local whitelist if the total number of intelligence is greater than a preset threshold. The system includes a security detection device and a cloud server. The security detection device comprises at least one first processor and a first memory connected in communication with the at least one first processor, wherein the first memory stores instructions executable by the at least one first processor, and the instructions are executed by the at least one first processor to enable the at least one first processor to perform the method for updating the customized embedded threat intelligence library according to any one of claims 1-8. The cloud server comprises at least one second processor and a second memory connected in communication with the at least one second processor, wherein the second memory stores instructions executable by the at least one second processor, and the instructions are executed by the at least one second processor to enable the at least one second processor to perform the method for updating the customized embedded threat intelligence library according to claim 1, 4 or 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to perform the method for updating the customized embedded threat intelligence library according to any one of claims 1-7.

Images